JOJO security record
As of 3 Nov 2026, JOJO has 1 audit report on Trustblock, by CertiK, dated 9 Dec 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
Findings18
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 4 | 0 | 11 |
Low`external` functions can accept `calldata` argumeJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
`external` functions can accept `calldata` arguments instead of `memory`, if the arguments are not modified. It allows to avoid copying and save gas.
Open the reportLow`liquidationThreshold` scaling factor can be declJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
`liquidationThreshold` is represented as a fixed-point number with the scaling factor `10**18`. It can be declared as a constant to improve the code readability. Same factor is used by `liquidationPriceOff`, `insuranceFeeRate`.
Open the reportLow`params` can use `storage` specifierJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
In `_isAllSafe()` the local variable `params` is declared as `memory`. However, only two fields are accessed. The variable can be declared as `storage`.
Open the reportLow`view` functions can be declared in `JOJOView`JOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
`JOJOExternal` implements several `view` functions: `isSafe()`, `isAllSafe()`, `getFundingRate()`. They can be moved to `JOJOView` for consistency.
Open the reportLowFailed `ERC2362.valueFor()` request is not handleJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
`EIP-2362` standard defines the status codes returned by `valueFor()`. `valueFor()` will return a status code of 404 if the value for an id is not available yet, 400 in case of bad request. `getMarkPrice()` doesn't handle the status codes.
Open the reportLowIncompatibility with Deflationary TokensJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f ```solidity=72 IERC20(state.secondaryAsset).safeTransferFrom( msg.sender, address(this), secondaryAmount ); ``` - Transferring tokens by `secondaryAmount`. ```solidity=77 state.secondaryCredit[to] += secondaryAmount; ``` - The `secondaryAmount` appears to be used for bookkeeping purposes without compensating the potential transfer fees.
Open the reportLowPerpetual asks the Dealer for `fundingRate`JOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
In `Perpetual.balanceOf()` current `fundingRate` is retrieved via `IDealer(owner()).getFundingRate(address(this))` instead of direct state field access. The trades and liquidations are settled using `fundingRate` directly.
Open the reportLowSecondary asset `decimals` is not checkedJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
`setSecondaryAsset()` allows to set any address as `secondaryAsset`. It can't later be reassigned. `decimals` is not checked, however, expected to be the same as `primaryAsset`. Wrong `secondaryAsset` will break the contract.
Open the reportLowTyposJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
"shoule" is supposed to be "should". "happens" is supposed to be "happen". "ALREASY" is supposed to be "ALREADY". "LEASE" is supposed to be "LEAST". "Operatiors" is supposed to be "Operators". "implemnents" is supposed to be "implementation". "newReducedCredkt" is supposed to be "newReducedCredit". "mathcing" is supposed to be "matching". "whold" is supposed to be "whole". And some others.
Open the reportLowUninitialized State Variable `roundId`JOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
One or more state variables are used without being initialized in the constructor. ```solidity=15 uint256 public roundId; ``` - `roundId` is never initialized, but used in `EmergencyOracle.setMarkPrice`.
Open the reportShow 1 more
LowVariables That Could Be Declared as ImmutableJOJO - Ⅲ · CertiK · 9 Dec 2022Fixed
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="jojo-2"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us